uPickle: JSON reader accepts invalid hex digits in unicode escapes and yields wrong characters
Reported · low · Soundness bug
The reader accepts escapes such as u00gZ, uXXXX or u0G00, does not reject them, and decodes them to arbitrary code points. Malformed JSON then produces wrong text without an error.
Found: ; reported: ; status since: . Reporter: Mike Murunov
Page for this report · Public report · Fix or proposed fix (see status)